Skip to content

zn-gate 1.4.1

Choose a tag to compare

View all tags
@tljohnsilver tljohnsilver released this 11 Oct 00:33
· 920 commits to main since this release
v1.4.1
d9da1b1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

1.4.0: with ZN_API_KEY set, tool results and tool-call arguments were sent to api.usezn.com for analysis without redaction. 1.4.1 removes that path entirely; cloud analysis is now opt-in (ZN_CLOUD=1), prompt-only and redacted.

  • Affected: the Node package up to and including 1.4.0, when ZN_API_KEY was set and ZN_LOCAL_ONLY was not true. Inputs blocked by the local rules were never sent. Without ZN_API_KEY nothing was sent.
  • Python up to 1.4.0: only analyze() and zn-gate analyze sent data, when ZN_API_KEY was set. guard, check_tool_*, sanitize_tool_result and the integrations were always local.
  • Recommended action: upgrade to 1.4.1. If you used 1.4.0 with ZN_API_KEY, consider rotating any credential that could have appeared in tool output. A security advisory with the full details follows.

Changed

  • Tool results, tool-call arguments and tool descriptions are evaluated only locally, under every configuration (MCP server, shield, library API).
  • Cloud analysis is opt-in: it requires both ZN_API_KEY and ZN_CLOUD=1, applies only to prompt analysis, and the text is passed through the secret redactor before sending. ZN_LOCAL_ONLY=true still overrides everything.
  • Secret redaction now runs on the real code path: check_tool_result always returns sanitized content, check_tool_call returns sanitized_arguments, and shield forwards allowed tool output with secrets redacted.
  • zn_status / zn-gate status report what leaves the machine. The self-test never uses the network.

Fixed

  • Python CLI: zn-gate test printed BLOCK when the verdict was allow and only the secret detector had fired. It now prints the real verdict and the DLP alert on its own line.
  • zn-gate init config locations verified against the official docs: Codex CLI (~/.codex/config.toml), OpenCode (~/.config/opencode/opencode.json), Claude Desktop on Linux (~/.config/Claude/). Files that cannot be rewritten safely are reported instead of modified.

Documentation

  • READMEs for GitHub, npm and PyPI rewritten around one path: what it is, one-command install per agent, a reproducible redaction check, what each piece does today, "What leaves your machine", measured numbers only.
  • Removed figures without a public method. One latency table remains, with hardware, date and the script to reproduce it.
  • Known limitation documented: false positives on whole source files in check_tool_result (not fixed in this release).

Packages: npm · PyPI

Assets 2
Loading